LRQA Nettitude Blog

By Tim Percival | VP of Cyber, APAC

After the recent cyber-attack on SolarWinds that exposed thousands of businesses across the world, the Singapore Monetary Authority (MAS) have stepped up measures to protect businesses in Singapore.

The new measures, which effect all financial services and e-payment firms, came into effect on Monday the 18th of January and introduce a new set of central banking rules to better mitigate technology risks. MAS have been actively working on the strengthening of cybersecurity standards for some time now, with measures including updating the MAS TRM guidelines. However, the recent breach of SolarWinds has meant that there’s new focus on implementing hardened cybersecurity measures with more emphasis on third party vendors.

By Nettitude

Happy New Year to all of our readers of the Global Regulatory Frameworks Compared Series! As a recap, in recent months, we have been taking a deep dive into the different regulatory bodies that govern the cybersecurity requirements of the Financial Sector. One of the key issues we’ve covered is the misalignment of cybersecurity standards across the board, which in turn led to the introduction of a pan-European framework that could be leveraged across the whole of the Eurozone – TIBER EU.

While the UK and Europe have a fairly coordinated approach with the CBEST and TIBER Frameworks, Asia has a slightly different approach. In part 4 of this series, we’ll be taking a look at the iCAST Framework, governed by the Hong Kong Monetary Authority (HKMA).

By Nettitude

With the recent hack of FireEye, there have been many questions circulating among Cybersecurity experts and the clients that they serve. At Nettitude we’re dedicated to providing the most robust and secure security practices to the people we serve.

In light of recent events, we’ve asked our security experts who, on a daily basis, are on the front lines of cybersecurity to answer the questions we received. We hope this information can help you keep yourself prepared, protected, and offer peace of mind that Nettitude is fully prepared to keep you protected.

By Stuart Wright | Global Head of Compliance and Risk

When we think about “insider threats” to our organisations, it’s all too easy for our minds to conjure up clichéd images of elaborate plots from a spy film, where the rookie agent goes undercover to get inside information, and then saves the day with just a few minutes to spare. Or perhaps we think about corporate espionage, where an unscrupulous employee infiltrates a competitor by getting a low-level admin job and creeping around the office late at night stealing valuable data that will give their employer a competitive edge.

The reality of the insider threat is almost always a little less exciting, and certainly less dramatic incidents are far more commonplace than the dramatised examples above.

There’s also a lot we can do to try and protect against these attacks, and in this blog post, we’ll talk about some of the key things you should be considering to help address the insider threat.

By Dan Ryder | Security Operations Team Lead at Nettitude

Cybersecurity teams often start out purchasing a SIEM solution with high hopes they have the staff, training, capability and organisational resources to get the most out of their new platform.

Unfortunately, in many cases the reality is that an already overstretched security team does not have the time needed to manage a SIEM, investigate alarms, manage rulesets, juggle compliance requirements, and ensure continuous proactive monitoring.  In the short term, the gap can be plugged through vendor professional services. However, this needs to be factored into costs on a rolling basis as the organisations attack surface evolves and is not a viable long-term solution.

One of the main contributors to why these internal deployments fail, have more hidden costs, and take more time than expected to utilise is alarm fatigue. In the following post, we’ll investigate what alarm fatigue is and the possible causes.

By Nettitude

Evidencing cybersecurity measures in ship architecture: How can Lloyd’s Register ShipRight Procedures help?

With cyber attacks increasing by 900% on the maritime industry over the last 3 years, it’s never been so important for this sector to address their cybersecurity landscape. As cyber-attackers develop increasingly sophisticated methods to infiltrate a ships operational technology, we are beginning to see that ship owners must now consider integrating cybersecurity requirements into the technical designs and architecture proposals for new builds and refits from an early stage.

As of January 2021, not only will it be in the interests of ship owners and operators to consult cybersecurity best practice as the foundations of ship development, it will be a requirement by the International Maritime Organisation. In order to keep a vessel ‘in class’, it is now essential for maritime organisations to be able to demonstrate a set of robust cybersecurity controls that are pragmatic, appropriate and relevant to the risks they face. So how can ship owners approach need and requirement?

By Dan Ryder, Jamie Roderick and Simon Robinson |  LRQA Nettitude SOC

In an ideal world, every cybersecurity alert received in a SOC would be malicious; displayed with context and enriched so that it would be immediately obvious to an analyst what has occurred, and there would be automation and task orchestration to deal with the threat and self-heal the network. But then, in an ideal world, there probably wouldn’t be any SOC alerts because the security posture of an organisation would make it invulnerable to attack or compromise, and there would be no malicious actors either.

In the following post, we’ll take a look at the absolutely key processes to review, update and assure SOC cyber threat detection, reduce false positives and improve your SOC's capabilities on a continuous basis.
This is delivered by our team of SOC Monitor experts, with over 30 years combined experience across Enterprise Network Security, protecting Critical National Infrastructure and industry leading security monitoring for financial FTSE 250 companies. We'll cover the important questions you need to ask yourself in ensuring your team keep up with Threat Actors, enable your teams situational awareness and empower your SOC across the following areas:

In our previous post in the ‘Global Regulatory Frameworks Compared’ series, we looked at the UK’s financial regulatory framework – CBEST. The CBEST framework which was brought in by BoE and the Financial Conduct Authority (FCA) in 2014 was the first step in a series of more proactive measures to combat the misalignment of cybersecurity standards across the board.

Four years later, TIBER-EU was published by ECB and the EU national central banks and approved by the Governing Council of the ECB. This was driven by the apparent need that other intelligence led assurance programmes have enhanced the resiliency of various financial systems. Consequently, multiple regulators around the world started to explore, creating their own frameworks.

Recognising the challenges of having multiple competing frameworks, the ECB decided to look at building a pan-European framework that could be leveraged across the whole of the Eurozone. Below, we’ll explore the TIBER- EU regulatory framework and analyse how it holds up against its global counterparts.

By Elisa Cassi | Product Development Manager at Nettitude

Cybersecurity is reaching the top of the agenda for many maritime organisations as IMO’s requirements for integrating cyber risk into onboard safety management systems come into force on the 1st of January 2021. The sector is already familiar with the concept of risk and with the creation of a risk management plan. What is required now is to include the cyber risk in the management plan.

But is this cyber risk real in the sector? We believe that “Yes” is the definitive answer and the IMO requirements will play a role in raising awareness of the online threats faced.

In this blog post, Nettitude provides a short summary of what shipowners and ship managers need to do to satisfy the new requirements and at the same time improve their cybersecurity posture.

By David Parsons | Security Consultant at LRQA Nettitude

With the improvements of vulnerability scanners and the ever-increasing proficiency of software such as WAFs and Intrusion Detection Systems, you may be asking yourself whether Penetration Testing is still a relevant way to ensure the security of your website. The following article discusses several proactive security considerations you should make when either creating, or maintaining a website and how Penetration Testing can be useful in this process.